TN-575: Open Source Network Security Monitoring teaches students how to deploy, build, and run an NSM operation using open source software and vendor-neutral tools. No network is bullet proof and when attackers access your network, this course will show you how to build a security net to detect, contain, and control the attacker. Sensitive data can be monitored and deep packet and deep attachment analysis can be achieved. As organizations stand up a Security Operations Center (SOC) the enterprise NSM is the key ingredient to that SOC. This course not only teaches how to implement an NSM technologically, but how to effectively monitor an enterprise operationally. You will learn how to architect an NSM solution: where to deploy your NSM platforms and how to size them, stand-alone or distributed, and integration into packet analysis, interpret evidence, and integrate threat intelligence from external sources to identify sophisticated attackers. A properly implemented NSM is integral to incident response and provides the responders timely information to react to the incident. TN-575: Open Source Network Security Monitoring is a lab intensive environment with a cyber range that gives each student in-depth knowledge and practical experience monitoring live systems to include: Cisco, Windows, Linux, IoT, and Firewalls.
Attendees to TN-575: Open Source Network Security Monitoring class will receive TechNow approved course materials and expert instruction.
This Course is taught utilizing Security Onion or RockNSM as specified by the customer.
Dates/Locations:
No Events
Duration: 5 Days
Course Objective:
The focus of this course is to present a suite of Open Source security products integrated into a highly functional and scalable Network Security Monitoring solution.
Prerequisites:
Students should have a basic understanding of networks, TCP/IP and standard protocols such as DNS, HTTP, etc. Some Linux knowledge/experience is recommended, but not required
Course Outline:
Network Security Monitoring (NSM) Methodology
High Bandwidth Packet Capture Challenges
Installation of Security Onion
Use Cases (analysis, lab, stand-alone, distributed)
Resource Requirements
Configuration
Setup Phase I – Network Configuration
Setup Phase 2 – Service Configuration
Evaluation Mode vs. Configuration Mode
Verifying Services
Security Onion Architecture
Configuration Files and Folders
Network Interfaces
Docker Environment
Security Onion Containers
Overview of Security Onion Analyst Tools
Kibana
CapME
CyberChef
Squert
Sguil
NetworkMiner
Quick Review of Wireshark and Packet Analysis
Display and Capture Filters
Analyze and Statistics Menu Options
Analysis for Signatures
Analyzing Alerts
Replaying Traffic
3 Primary Interfaces:
Squert
Sguil
Kibana
Pivoting Between Interfaces
Pivoting to Full Packet Capture
Snort and Surricata
Rule Syntax and Construction
Implementing Custom Rules
Implementing Whitelists and Blacklists
Hunting
Using Kibana to Slice and Dice Logs
Hunting Workflow with Kibana
Bro
Introduction and Overview
Architecture, Commands
Understanding and Examining Bro Logs
Using AWK, sort, uniq, and bro-cut
Working with traces/PCAPs
Bro Scripts Overview
Loading and Using Scripts
Bro Frameworks Overview
Bro File Analysis Framework FAF
Using Bro scripts to carve out more than files
RockNSM ( * If Applicable)
Kafka
Installation and Configuration
Kafka Messaging
Brokers
Integration with Bro and FSF
File Scanning Framework FSF
Custom YARA Signatures
JSON Trees
Sub-Object Recursion
Bro and Suricata Integration
Elastic Stack
Adding new data sources in Logstash
Enriching data with Logstash
Automating with Elastalert
Building new Kibana dashboards
Production Deployment
Advanced Setup
Master vs Sensor
Node Types – Master, Forward, Heavy, Storage
Command Line Setup with sosetup.conf
Architectural Recommendations
Sensor Placement
Hardening
Administration
Maintenance
Tuning
Using PulledPork to Disable Rules
BPF’s to Filter Traffic
Spinning up Additional Snort / Suricata / Bro Workers to Handle Higher Traffic Loads
The Microsoft platform is arguably the largest component in any IT architecture, and rate of change in this arena makes training in the Microsoft platform a must. TechNow can and does teach the entire gamut of Microsoft technologies, from Servers to application development.
AWS System Operations begins with a one day introduction to AWS products, services, and common solutions. It provides you with fundamentals to become more proficient in identifying AWS services so that you can make informed decisions about IT solutions based on your business requirements and get started working on AWS.
The AWS course continues to flow with teaching those in a Systems Administrator or Developer Operations (DevOps) role how to create automatable and repeatable deployments of networks and systems on the AWS platform. The course covers the specific AWS features and tools related to configuration and deployment, as well as common techniques used throughout the industry for configuring and deploying systems.
To continue to learn more about AWS, TechNow has the following course:
Attendees to CL-415: AWS System Operations will receive TechNow approved course materials and expert instruction.
Duration: 5 Days
Audience:
This course is intended for:
• System Administrators
• Software Developers, especially those in a Developer Operations (DevOps) role
DoD 8140: Not Mandated
Course Prerequisites:
We recommend that attendees of this course have the following prerequisites:
• Background in either software development or systems administration
• Some experience with maintaining operating systems at the command line (shell scripting in Linux environments, cmd or PowerShell in Windows)
• Basic knowledge of networking protocols (TCP/IP, HTTP)
Course Objectives:
This course is designed to teach you how to:
• Understand basic data center design concepts.
• Recognize terminology and concepts as they relate to the AWS platform and navigate the AWS Management Console.
• Understand the foundational infrastructure services, including Amazon Virtual Private Cloud (VPC), Amazon Elastic Compute Cloud (EC2), Amazon Elastic Block Store (EBS), Amazon Simple Storage Service (S3), Auto Scaling, and Elastic Load Balancing (ELB).
• Understand the security measures AWS provides and key concepts of AWS Identity and Access Management (IAM).
• Understand AWS database services, including Amazon DynamoDB and Amazon Relational Database Service (RDS).
• Understand AWS management tools, including Amazon CloudWatch and AWS Trusted Advisor.
• Use standard AWS infrastructure features such as Amazon Virtual Private Cloud (VPC), Amazon Elastic Compute Cloud (EC2), Elastic Load Balancing, and Auto Scaling from the command line
• Use AWS CloudFormation and other automation technologies to produce stacks of AWS resources that can be deployed in an automated, repeatable fashion
• Build functioning virtual private networks with Amazon VPC from the ground up using the AWS Management Console
• Deploy Amazon EC2 instances using command line calls and troubleshoot the most common problems with instances
• Monitor the health of Amazon EC2 instances and other AWS services
• Manage user identity, AWS permissions, and security in the cloud
• Manage resource consumption in an AWS account using tools such as Amazon CloudWatch, tagging, and Trusted Advisor
• Select and implement the best strategy for creating reusable Amazon EC2 instances
• Configure a set of Amazon EC2 instances that launch behind a load balancer, with the system scaling up and down in response to demand
• Edit and troubleshoot a basic AWS CloudFormation stack definition
Dates/Locations:
No Events
Course Outline:
Day 1
• Introduction and History of AWS
• AWS Infrastructure: Compute, Storage, and Networking
• AWS Security, Identity, and Access Management
• AWS Databases
• AWS Management Tools
Day 2
• System Operations on AWS Overview
• Networking in the Cloud
• Computing in the Cloud Day 3
• Storage and Archiving in the Cloud
• Monitoring in the Cloud
• Managing Resource Consumption in the Cloud Day 4
• Configuration Management in the Cloud
• Creating Scalable Deployments in the Cloud
• Creating Automated and Repeatable Deployments Day 5 Full Day Lab
• Select the appropriate AWS service based on compute, data, or security requirements
• Execute steps required to provision cloud resources for selected deployment
• Identify and implement data protection, encryption, and capacity planning
• Implement and manage security policies, access controls, and role
• Implement Automation
This course engages students by providing in-depth knowledge of the most prominent and powerful attack vectors and an environment to perform these attacks in numerous hands-on scenarios. This course goes far beyond simple scanning for low-hanging fruit, and shows penetration testers how to model the abilities of an advanced attacker to find significant flaws in a target environment and demonstrate the business risk associated with these flaws.
A skills focus enables the student to better absorb the subject matter and perform successfully on the job. This is not death by power point. The course is aligned with information assurance operators and executing hands-on labs. Lecture and labs walk the student through the knowledge required to truly understand the mechanics of the attacks and the effectiveness.
Attendees to TN-989: Advanced Penetration Testing, Exploits, and Ethical Hacking course will receive TechNow approved course materials and expert instruction.
Date/Locations:
No Events
Course Duration: 5 days
Course Objectives:
Accessing the Network
Advanced Fuzzing Techniques
Advanced Stack Smashing
Attacking the Windows Domain – Enumeration
Attacking the Windows Domain – Restricted Desktops
